ACE-Associate flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Resource hierarchy inheritance

IAM policies set at an organization, folder, or project apply to all descendant resources; a child policy can only add grants, never remove inherited ones.

gcloud configurations

Named sets of SDK properties such as project, account, and zone. Creating and activating a configuration switches context without editing global settings.

Default VPC network

A pre-created auto mode network with one subnet per region using a /20 range, plus default firewall rules allowing internal traffic and SSH/RDP.

Enabling a service API

Most Google Cloud services must be enabled per project before use; the command gcloud services enable activates the API for that project.

Billing account linkage

A billing account pays for project usage. A project linked to an inactive or unlinked billing account cannot consume billable services.

Organization node requirement

The root of the hierarchy is created automatically for Cloud Identity or Workspace domains; standalone consumer accounts have no organization node.

Project quotas

Per-project, often per-region limits on resource counts or API rates. Exceeding a quota causes request failures until usage drops or a quota increase is approved.

Cloud Run use case

A managed serverless platform for stateless containers that scales to zero; suited to HTTP services where you supply the container image.

Cloud Storage classes

Standard, Nearline, Coldline, and Archive trade retrieval cost and latency for lower storage price; minimum storage durations are 0, 30, 90, and 365 days.

Regional vs multi-region bucket

A regional bucket stores objects in one region for latency or data-residency needs; a multi-region bucket replicates across a large geographic area for availability.

Cloud SQL vs Spanner

Cloud SQL is a managed single-region relational database for MySQL, PostgreSQL, or SQL Server. Spanner is globally distributed with strong consistency and horizontal scaling.

BigQuery partitioning

Dividing a table by a date/timestamp column or ingestion time so queries scan only relevant partitions, reducing bytes billed and improving performance.

Regional managed instance group

A group of identical VMs from an instance template spread across zones in one region, supporting autoscaling and autohealing for higher availability.

Global HTTP(S) load balancer

A Layer 7 load balancer with a global anycast IP that routes requests to backends in multiple regions based on URL maps and health checks.

Infrastructure as Code benefit

Declaring resources in version-controlled templates (Terraform or Deployment Manager) makes environments reproducible, reviewable, and consistent across deployments.

Cloud Storage durability

Object storage is designed for 99.999999999 percent annual durability by redundantly storing data; availability differs and depends on the chosen location type.

Log sinks

Cloud Logging routes log entries to destinations such as Cloud Storage, BigQuery, or Pub/Sub, filtered by inclusion and exclusion queries at the sink level.

Ops Agent

The unified agent for Compute Engine VMs that collects system metrics and logs and sends them to Cloud Monitoring and Cloud Logging.

Alerting policy

A Cloud Monitoring rule combining a metric condition, an evaluation window, and notification channels that fires incidents when the condition is met.

Error budget

The allowed unreliability derived as 100 percent minus the SLO target; it quantifies how much failure a service can absorb within a compliance window.

Autohealing

A managed instance group feature that uses a health check to detect unhealthy instances and automatically recreates them to restore capacity.

Persistent Disk snapshot

An incremental, differential backup of a disk stored in Cloud Storage; subsequent snapshots capture only blocks changed since the previous one.

Cloud SQL point-in-time recovery

Restoring a Cloud SQL instance to a specific moment using automated backups combined with binary logs, within the configured retention window.

Budget alert

A Cloud Billing notification triggered when spend crosses configured thresholds; it informs stakeholders but does not stop or cap resource usage.

Uptime check

A Cloud Monitoring probe that requests a public or private endpoint from multiple locations to verify availability and measure response latency.

Predefined vs primitive roles

Primitive roles (Owner, Editor, Viewer) grant broad project-wide access; predefined roles grant granular permissions for a specific service and follow least privilege.

Service account

A non-human identity used by workloads and VMs to authenticate to Google Cloud APIs and receive IAM role grants on resources.

Workload Identity Federation

A mechanism letting external workloads (for example AWS or OIDC providers) obtain short-lived Google Cloud credentials without exporting service account keys.

VPC firewall rule behavior

Firewall rules are stateful: allowed ingress return traffic is permitted automatically. Rules are evaluated by priority, and a matching deny blocks the connection.

Identity-Aware Proxy

A service that checks user identity and context before granting access to HTTP(S) apps or TCP-forwarded ports, avoiding exposure through public IP addresses.

Customer-managed encryption keys

Keys you create and control in Cloud KMS that a service uses to encrypt your data, giving you control over rotation and revocation.

VPC Service Controls perimeter

A security boundary around projects and services that restricts data movement and blocks access from outside the perimeter, mitigating exfiltration risk.

Admin Activity audit logs

Audit logs recording configuration and metadata changes; they are always enabled, free of charge, and retained for 400 days.